0

I have an OpenVPN server running on my Synology NAS on local IP 192.168.9.36. I have an application on the NAS running on local IP 192.168.9.36:1234 and I have a reverse proxy that allows me to access my app over secure HTTPS (i.e. proxies https://myNAS.app to http://192.168.9.36:1234). I also have a DNS server on the NAS running on local IP 192.168.9.36 with a local DNS record that points myNAS.app to IP 192.168.9.36.

In my local network everything is fine: I can access my app with either http://192.168.9.36:1234 and https://myNAS.app.

The problem resides when I am away from home and connect my mobile phone via an OpenVPN client to the OpenVPN server on the NAS to access my home network. In this situation I can access my app by its IP but NOT using its domain name (https://myNAS.app).

I believe OpenVPN is failing to push my local DNS server. In my VPN client configuration file (VPNConfig.ovpn) I have the following directives:

redirect-gateway def1
dhcp-option DNS 192.168.9.36
dhcp-option DNS 8.8.8.8

When connected to the VPN and querying my current DNS server, I am told that I am using Google (8.8.8.8) which should be the secondary and not primary DNS.

What am I doing wrong? Why is 192.168.9.36 not being pushed as my primary DNS to my mobile phone over the VPN connection?

Note: all addresses are fictional, not intended to be clicked.

From comment by OP

I am using an iPhone with iOS, cellular data when connecting to the VPN. VPN is running on Synology official VPN Server package but for DNS I'm using Pi-VPN running on the NAS in a docker container. If I remove the DNS entry for Google I am unable to reach any website by domain name, either local or public on the internet. (one note: in the OpenVPN config file it says I can have 2 entries, a primary and secondary).

Improve this question
3
  • 2
    You did not specify the mobile device. You did not specify if your DNS server is a resolver or only an authoritative DNS server for a private zone. What happens if you remove the DNS entry for Google? This should allow private zone resolution and public if your DNS server is set up to also be a resolver. Your current DNS setup for the mobile client is not correct in that you are specifying two DNS servers without a split-horizon configuration.
    – John Hanley
    Commented Mar 19, 2021 at 2:34
  • Thank you for your comment. I am using an iPhone with iOS, celular data when connecting to the VPN. VPN is running on Synology official VPN Server package but for DNS I'm using Pi-VPN running on the NAS in a docker container. If I remove the DNS entry for Google I am unable to reach any website by domain name, either local or public on the internet. (one note: in the openVPN config file it says I can have 2 entries, a primary and secondary).
    – BMM
    Commented Mar 19, 2021 at 9:49
  • 1
    Yes, you can enter two DNS servers (primary and secondary), but they should provide the same information. The secondary is a backup/clone for the primary, not two different DNS servers providing different zone information. You cannot implement split-horizon DNS by using two different entries. You will just get different answers/failures depending on which server responds first. Some stub resolvers will send a DNS request to both servers at the same time, others will only send a request to the secondary if the primary times out.
    – John Hanley
    Commented Mar 19, 2021 at 16:44

1 Answer 1

Reset to default
0

After some digging found that Pi-Hole DNS was not listening to requests being made by the VPN, only local requests. Changing the option accordingly to the image below fixed the issue and should pose not problem since Pi-Hole is behing the router, and only one port is open on it for the VPN.

enter image description here

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .